From: Matt Caswell <matt@openssl.org>
Date: Wed, 1 Apr 2020 15:10:08 +0000 (+0100)
Subject: Explicitly cache the X509v3_extensions in one more place in libssl
X-Git-Tag: openssl-3.0.0-alpha1~135
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=e66c37deb64d4e4ab0c2d63b817760d387eb9ed8;p=oweals%2Fopenssl.git

Explicitly cache the X509v3_extensions in one more place in libssl

Make sure we cache the extensions for a cert using the right libctx.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11457)
---

diff --git a/ssl/ssl_rsa.c b/ssl/ssl_rsa.c
index ac9d01a766..09b965fc19 100644
--- a/ssl/ssl_rsa.c
+++ b/ssl/ssl_rsa.c
@@ -1055,9 +1055,15 @@ static int ssl_set_cert_and_key(SSL *ssl, SSL_CTX *ctx, X509 *x509, EVP_PKEY *pr
     int j;
     int rv;
     CERT *c = ssl != NULL ? ssl->cert : ctx->cert;
+    SSL_CTX *actualctx = ssl == NULL ? ctx : ssl->ctx;
     STACK_OF(X509) *dup_chain = NULL;
     EVP_PKEY *pubkey = NULL;
 
+    if (!X509v3_cache_extensions(x509, actualctx->libctx, actualctx->propq)) {
+        SSLerr(0, ERR_R_X509_LIB);
+        goto out;
+    }
+
     /* Do all security checks before anything else */
     rv = ssl_security_cert(ssl, ctx, x509, 0, 1);
     if (rv != 1) {